When a CFO asks “where does our data go?”, a hosting location is only the start of the answer. The database may be private while prompts go to an external model. An agent may have read-only access yet use the wrong definition of margin.
Customer control means being able to inspect and govern each of those decisions. I find it useful to separate four questions: where the evidence lives, which model receives it, what can execute, and who owns the business definition.
Where does control sit?
Source records, extracted text and freshness.
The configured inference route and provider.
Tools, permissions and operating responsibility.
Published rules, versions and required review.
Where Does the Evidence Live?
Start with the actual data path. A connector brings scoped records from a source such as Xero into the selected MLX environment. Its permissions determine what it can read; its sync history shows how current that evidence is.
Stored records, extracted document text, prompts, outputs and logs may follow different paths. A useful deployment review names each destination and the people who can access it. “Hosted in our VPC” is incomplete if it describes only the database.
If a task uses an external model, the context sent with that call leaves for the configured provider. If it uses an in-boundary model, verify that route separately. Neither follows automatically from where connector data is stored.
Which Model Handles the Work?
The model and the business definition should be separate choices. A team should be able to evaluate a different model without rewriting what “overdue” means or changing the accounts included in a revenue measure.
MLX keeps model routing separate from its published Twin definitions. The routes available to a particular organisation still depend on configuration and access policy. Project Venus explores models on infrastructure we control; research and integration progress should not be read as availability in every customer deployment.
A model change also needs testing. Can the replacement use the permitted tools, preserve the returned amounts and explain missing evidence? A cheaper call is not a saving if it produces commentary someone has to repair.
What Can the Agent Do?
An execution boundary has two parts: where the work runs and which operations it may perform.
A private server can still host an over-permissioned agent. Conversely, a tightly scoped read-only workflow can be useful without giving the model terminal access or credentials for the whole estate.
MLX grants the capabilities permitted by both the request and the applicable policy. Individual tools must then enforce their own inputs and permissions. Permission to analyse receivables does not imply permission to send reminders or mark invoices as paid.
For the deployment you are considering, establish who operates the runtime, who can change its configuration, and how access, failures and material actions are recorded.
Who Owns the Definition?
Suppose an agent reports that a customer is profitable. Which revenue basis did it use? Which delivery costs were included? Was the customer mapped to the right projects?
Those decisions belong in a published business definition. In MLX, a Twin view contract describes the data an agent may query: its fields, row meaning, permitted calculations and supporting evidence. This is also called a Twin product in earlier articles.
The definition is checked before it becomes available to governed queries. The current authoring path combines automated validation, independent semantic evaluation and policy admission. Human review remains necessary where the organisation's policy or an unresolved business decision requires it; it is not a universal manual step for every publication.
For a consequential metric, the business owner still needs to accept its use. Automated checks can establish declared properties. They cannot decide whether a margin measure is appropriate for a lending decision.
Ask to Inspect One Answer
The most useful demonstration is a real question through the proposed deployment. Ask the operator to show:
- the signed-in user and organisation;
- the model and tools that actually ran;
- the published definition and version used;
- the freshness of its sources;
- any missing evidence or approval still required.
A product citation and execution record can support that investigation. They do not automatically provide transaction-level drill-down: the definition must preserve the relevant source references.
Customer control becomes concrete when your team can inspect those decisions, change the ones it owns, and explain who is responsible for the rest.
A few practical questions.
What does customer-controlled AI mean?
The organisation can inspect and govern where evidence lives, which model receives context, what execution permits and which business definitions apply. The available controls and responsibilities must be established for its deployment.
Does a private deployment keep all model context inside our environment?
Not automatically. A call to an external provider sends context along that route. An in-boundary inference route must be configured and verified separately from application or database hosting.
Does every Twin definition require a manual approval?
No. The current authoring path combines automated validation, independent semantic evaluation and policy admission. Human review applies where policy requires it or a business decision remains unresolved.